Enterprise attestation query

[Ujjwal Roy]

Hi All

I have a few questions regarding the enterprise attestation feature for authenticators as outlined below:

• Enterprise attestation may include uniquely identifying information. Does this attestation need to be unique for each individual authenticator or can an enterprise/vendor issue a single attestation for a batch of authenticators using a common enterprise key and certificate, similar to basic attestation (as currently expected by the conformance tool)?
• Are there established mechanisms for implementing this feature or do enterprises/vendors have the flexibility to decide how to implement it?
• If the enterprise attestation must be unique for each individual authenticator, does this require the use of chip-specific enterprise keys and certificates?
  • If that is the case, is there specific guidance on implementation such as including the chip serial number in the certificate?

 

Regards,
Ujjwal Roy

[Shane Weeden]

this is relevant

Sent from my iPhone

On 8 Jan 2026, at 4:28 pm, Ujjwal Roy <ujjw...@gmail.com> wrote:



--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.
To view this discussion visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/cf86df89-7a2e-4974-bcec-7c0651369b0en%40fidoalliance.org.

[My1]

https://fidoalliance.org/specs/fido-v2.2-ps-20250714/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html#sctn-feature-descriptions-enterp-attstn

Here it says also that it MAY include uniquely identifying info. 

RFC2119 defines may as in that this is free to choose. 

So I'd guess theoretically an EP may have info to identify individual ones but you could theoretically also use a batch thing if you only want to define them as the tokens for your company specifically. 

To view this discussion visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/606683CF-D26D-4594-9214-D2F557CF2353%40gmail.com.